Fix double free()